Use getUser() Instead of getSession()

Why this matters

supabase.auth.getSession() reads the JWT from the browser's cookies and decodes it without re-verifying the token with the Supabase Auth server. This means:

• An attacker can modify the JWT payload in their cookies
• Your server-side code will trust the forged claims (user ID, role, email)
• Authorization checks based on session.user are completely bypassable

This is not a minor issue — it is a full authentication bypass on the server side.

The rule

On the server side (Server Components, Server Actions, API Routes, middleware), always use getUser() instead of getSession() when you need to verify who the user is.

getUser() sends the token to the Supabase Auth server for verification, confirming it has not been tampered with or revoked.

Bad example

// Server Action — INSECURE
export async function deleteAccount() {
  const supabase = await createClient();
  const { data: { session } } = await supabase.auth.getSession();
  
  if (!session) throw new Error("Not authenticated");
  
  // DANGER: session.user.id could be forged!
  await supabase.from("profiles").delete().eq("id", session.user.id);
}

Good example

// Server Action — SECURE
export async function deleteAccount() {
  const supabase = await createClient();
  const { data: { user }, error } = await supabase.auth.getUser();
  
  if (error || !user) throw new Error("Not authenticated");
  
  // user.id is verified by the auth server
  await supabase.from("profiles").delete().eq("id", user.id);
}

When getSession() is acceptable

• Client-side only — for optimistic UI updates where the data is not trusted for authorization decisions
• Reading non-sensitive display data — showing the user's name or avatar in the navigation bar
• Never for authorization decisions, data mutations, or access control on the server

How to detect

Search your server-side code for getSession():

grep -rn "getSession()" app/ lib/ --include="*.ts" --include="*.tsx"

Any occurrence in a Server Component, Server Action, API route, or middleware is a finding.

Remediation

1. Replace supabase.auth.getSession() with supabase.auth.getUser() on all server-side code paths
2. Update destructuring — getUser() returns { data: { user }, error } instead of { data: { session } }
3. Add a grep check to CI to prevent future regressions

References

• Supabase Auth: Server-Side Rendering
• Supabase Auth: getUser() Reference